This popular VPN has been hit by a major security vulnerability

A security researcher has discovered a new vulnerability in the VPN service SaferVPN that could allow for local privilege escalation on Windows systems.

The local privilege escalation vulnerability was discovered by a researcher known as nmht3t who previously disclosed the fact that SaferVPN silently fixed a DoS vulnerability in its VPN client last September. In a new blog post on Medium, mmht3t revealed why he chose to publicly disclose his latest discovery, saying:

“SaferVPN does not fix this vulnerability even after a 90-day disclosure deadline. Therefore, there is no patch available at the moment for this product. In order to inform the users of the vulnerability, I decided to publicly disclose the vulnerability.”

Security researchers often give companies a 90-day deadline to fix any vulnerabilities before they disclose them publicly. As SaferVPN failed to patch this latest vulnerability in a timely manner, mmht3t felt it was in the best interest of the company’s users to warn them about it.

Local privilege escalation flaw

According to mmht3t’s vulnerability summary, when SaferVPN attempts to connect to a VPN server it spawns the OpenVPN executable in the context of NT AUTHORITYSYSTEM. The service’s VPN client then tries to load an openssl.cnf configuration file from a non-existing folder (C:etcsslopenssl.cnf).

However, as a low-privileged users is able to create folders under C: on Windows, it’s possible for them to create the appropriate path and place a crafted openssl.cnf file in it. Once OpenVPN starts in SaferVPN, this file can load a malicious OpenSSL engine library which results in arbitrary code execution as SYSTEM.

SaferVPN versions to 5.04.15 are vulnerable to this local privilege escalation flaw tracked as CVE-2020–26050.

Mmht3t first discovered this vulnerability earlier this year and they sent the details of the vulnerability to SaferVPN in July. After a follow up with no response from the company and informing them that the 90-day disclosure deadline was approaching, mmht3t decided to make their findings public in January.

About the author

Bob Luthar

Bob Luthar

After serving as a lead author in leading magazines, Bob planned to launch its own venture as TheMarketActivity. With a decade-long work experience in the media and passion in technology and gadgets, he founded this website. Luthar now enjoys writing on tech and software related topics. When he’s not hunched over the keyboard, Bob spends his time engulfed in Sci-Fi/Fantasy novels and movies.
Email: [email protected]

Add Comment

Click here to post a comment